Windows系统API函数拦截技术研究

API函数拦截是指通过特定的方法中断API函数的调用,转而执行用户的功能代码的一种行为。该技术由代码加载和用户代码组成。文中首先详细讨论了Windows系统中三种代码加载技术:Hook(钩子)、使用动态链接库的远线程插入和使用代码段的远线程插入。同时对这三种技术的优缺点进行了分析,给出了它们各自的应用场合。最后给出了一种函数拦截系统的设计和实现。

Research of Technology of Intercepting API calls in Windows

Intercepting API calls means a way of alter the original API execution to the code supplied by the user. This technology consists of loader and code. Firstly, This paper discussed three mean used to load the code in detail including hook, create remote thread with DLL and create remote thread with pieces of code. At the same time their advantage and disadvantage are analyzed. Fi- nally, it designs a system of intercepting API calls that is composed by loader and code.